NtGetNextThread

NTSTATUS __stdcall NtGetNextThread(
        PVOID ProcessHandle,
        PVOID ThreadHandle,
        UINT64 DesiredAccess,
        UINT64 HandleAttributes,
        UINT64 Flags,
        PVOID *NewThreadHandle){
  int v6; 
  KPROCESSOR_MODE v9; 
  __int64 v10; 
  NTSTATUS v11; 
  NTSTATUS AccessState; 
  _DWORD *NextProcessThread; 
  _ETHREAD *CurrentThread; 
  PVOID v15; 
  PVOID v16; 
  bool v17; 
  PVOID Object; 
  UINT64 DesiredAccessa; 
  PVOID v20; 
  void *Handle; 
  _DWORD *v22; 
  PVOID *v23; 
  _ETHREAD *v24; 
  INT64 result[2]; 
  int v26; 
  int v27; 
  __int64 v28[28]; 
  v6 = HandleAttributes;
  LODWORD(DesiredAccessa) = DesiredAccess;
  v23 = NewThreadHandle;
  Object = 0i64;
  v20 = 0i64;
  memset((INT64)result, 0i64);
  memset((INT64)v28, 0i64);
  Handle = 0i64;
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v9 )
  {
    v10 = (__int64)NewThreadHandle;
    if( (unsigned __int64)NewThreadHandle >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v10 = *(_QWORD *)v10;
  }
  *NewThreadHandle = 0i64;
  if( (_DWORD)Flags )
    return -1073741811;
  v11 = ObReferenceObjectByHandleWithTag(
          ProcessHandle,
          0x400u,
          (POBJECT_TYPE)PsProcessType,
          v9,
          0x6E457350u,
          &Object,
          0i64);
  if( v11 >= 0 )
  {
    if( ThreadHandle )
    {
      AccessState = ObReferenceObjectByHandleWithTag(
                      ThreadHandle,
                      0,
                      (POBJECT_TYPE)PsThreadType,
                      v9,
                      0x6E457350u,
                      &v20,
                      0i64);
      if( AccessState < 0 )
        goto LABEL_26;
      if( *((PVOID *)v20 + 68) != Object )
      {
        ObfDereferenceObjectWithTag(v20, 0x6E457350ui64);
        AccessState = -1073741811;
        goto LABEL_26;
      }
    }
    NextProcessThread = PsGetNextProcessThread((__int64)Object, v20);
    v22 = NextProcessThread;
    if( NextProcessThread )
    {
      v17 = SeSinglePrivilegeCheck(*(_QWORD *)&SeDebugPrivilege, v9) != 0;
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      v24 = CurrentThread;
      v15 = Object;
      do
      {
        if( (NextProcessThread[324] & 2) != 0
          || (PsSynchronizeWithThreadInsertion((__int64)NextProcessThread, (__int64)CurrentThread),
              (NextProcessThread[324] & 2) != 0) )
        {
          AccessState = SeCreateAccessState(
                          (_ACCESS_STATE *)result,
                          (_AUX_ACCESS_DATA *)v28,
                          (unsigned int)DesiredAccessa,
                          (_GENERIC_MAPPING *)((char *)PsProcessType + 76));
          if( AccessState < 0 )
            goto LABEL_20;
          if( v17 )
          {
            if( (v26 & 0x2000000) != 0 )
              v27 |= 0x1FFFFFu;
            else
              v27 |= v26;
            v26 = 0;
          }
          AccessState = ObOpenObjectByPointer(
                          NextProcessThread,
                          v6 & (v9 != 0 ? 7666 : 73714),
                          (PACCESS_STATE)result,
                          0,
                          (POBJECT_TYPE)PsThreadType,
                          v9,
                          &Handle);
          SeDeleteAccessState((_ACCESS_STATE *)result);
          if( AccessState >= 0 )
          {
            *v23 = Handle;
            goto LABEL_20;
          }
          if( AccessState != -1073741790 )
            goto LABEL_20;
        }
        NextProcessThread = PsGetNextProcessThread((__int64)v15, NextProcessThread);
        v22 = NextProcessThread;
        CurrentThread = v24;
      }
      while( NextProcessThread );
      AccessState = -2147483622;
LABEL_20:
      ObfDereferenceObjectWithTag(v15, 0x6E457350ui64);
      if( !NextProcessThread )
        return AccessState;
      v16 = NextProcessThread;
LABEL_22:
      ObfDereferenceObjectWithTag(v16, 0x6E457350ui64);
      return AccessState;
    }
    AccessState = -2147483622;
LABEL_26:
    v16 = Object;
    goto LABEL_22;
  }
  return v11;
}

Referenced by: